spring-projects/spring-security · error · IllegalStateException

Unauthenticated or no response token

Error message

Unauthenticated or no response token

What it means

getEncodedResponseToken returns the Base64-encoded mutual-authentication response token from the validated ticket. It throws IllegalStateException if the token has no response token (authentication didn't produce one) or ticket validation data is missing — i.e. it was called on a token that was never successfully authenticated.

Source

Thrown at kerberos/kerberos-core/src/main/java/org/springframework/security/kerberos/authentication/KerberosServiceRequestToken.java:173

	public @Nullable KerberosTicketValidation getTicketValidation() {
		return this.ticketValidation;
	}

	/**
	 * Determines whether an authenticated token has a response token.
	 * @return whether a response token is available
	 */
	public boolean hasResponseToken() {
		return this.ticketValidation != null && this.ticketValidation.responseToken() != null;
	}

	/**
	 * Gets the (Base64) encoded response token assuming one is available.
	 * @return encoded response token
	 */
	public String getEncodedResponseToken() {
		if (!hasResponseToken()) {
			throw new IllegalStateException("Unauthenticated or no response token");
		}
		if (this.ticketValidation == null) {
			throw new IllegalStateException("Ticket validation is not available");
		}
		return Base64.getEncoder().encodeToString(this.ticketValidation.responseToken());
	}

	/**
	 * Unwraps an encrypted message using the gss context.
	 * @param data the data
	 * @param offset data offset
	 * @param length data length
	 * @return the decrypted message
	 * @throws PrivilegedActionException if jaas throws and error
	 */
	public byte[] decrypt(final byte[] data, final int offset, final int length) throws PrivilegedActionException {
		KerberosTicketValidation validation = getTicketValidation();
		if (validation == null) {

View on GitHub (pinned to 96852e8860)

Solutions

1. Guard with token.hasResponseToken() before calling getEncodedResponseToken().
2. Enable mutual authentication in the ticket validator so a response token is produced (setVerbose/mutualAuthentication settings depending on validator).
3. Verify the token passed to the success handler is the authenticated KerberosServiceRequestToken with ticketValidation set.
4. If mutual auth is not needed, skip response-token emission instead of calling this method.

Example fix

// before
String token = kerberosToken.getEncodedResponseToken();
response.addHeader("WWW-Authenticate", "Negotiate " + token);
// after
if (kerberosToken.hasResponseToken()) {
  response.addHeader("WWW-Authenticate",
      "Negotiate " + kerberosToken.getEncodedResponseToken());
}

if (kerberosToken.hasResponseToken()) {
  String b64 = kerberosToken.getEncodedResponseToken();
} // else skip WWW-Authenticate: Negotiate response

try {
  String encoded = kerberosToken.getEncodedResponseToken();
  response.setHeader("WWW-Authenticate", "Negotiate " + encoded);
} catch (IllegalStateException e) {
  LOG.debug("No mutual-auth response token available; skipping", e);
}

When it happens

Trigger: Calling getEncodedResponseToken() on a KerberosServiceRequestToken before successful authentication, or after validation that produced a null responseToken (e.g. SunJaasKerberosTicketValidator without mutual authentication enabled).

Common situations: Custom success handlers (onAuthenticationSuccess) assuming a response token always exists; using a ticket validator that doesn't return a response token so the SPNEGO 'continue required' handshake can't complete (e.g. with browsers expecting mutual auth).

Understand the failure class

Background: "Invalid state transition" errors: "status must be X, actually Y", "already rejected/charging/uninstalled", "cannot ... while running" — what they mean when a library rejects your call — this error's family across 31 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Error running rest call
• ticketValidator must be set
• userDetailsService must be set
• Kerberos validation not successful
• GSSContext name of the context initiator is null

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/653bd10d56a50219. Report an issue: GitHub.